Messages posted by: ketusa

ASM is best ! pascal too

đầu tiên login dô root account

các bạn mở file "php.ini" trong pico editor

[ pico /usr/local/lib/php.ini ]

tìm "safe_mode"

[ Ctrl + W and type "safe_mode" ]

đổi Off thành On

[ "safe_mode = Off" to "safe_mode = On" ]

tìm "disabled_functions"

[ Ctrl + W and type "disabled_functions" ]

và add theo functions

[system, exec, shell_exec, passthru, pcntl_exec, putenv, proc_close, proc_get_status, proc_nice, proc_open, proc_terminate, popen, pclose, set_time_limit, ini_alter, virtual, openlog, escapeshellcmd, escapeshellarg, dl, curl_exec, parse_ini_file, show_source]

sau đó save lại
[ Ctrl + X then Y ]

retart lại Apache web server
[ /etc/init.d/httpd restart ]

done. bây h hết sợ hack local rồi nhá smilie

)

chú ý nên backup php.ini trước khi bắt đầu. hehe

Trước tiên đọc tại đây để biết thông tin đã nhe
http://vietnamnet.vn/cntt/2006/07/594778/

I was thinking on different lines, possibly one can use magic values of
different types of executables along with "filetype:" keyword.

For Example:
EXE -- 0x5A4D
NT -- 0x4550
OS2 -- 0x454E
OS2 LE -- 0x454C
VXD -- 0x454C

Now, if one has to search for malicious binaries in the form of .scr, .com
or .pif etc then (s)he can issue the following search keywords -

"intext: signature: 5A4D" filetype:scr
"intext: signature: 5A4D" filetype:pif
"intext: signature: 5A4D" filetype:doc

or (without using "intext")

signature: 00004550 filetype:scr
signature: 00004550 filetype:doc

The results can be narrowed down using a signature database like the one
being used here

http://metasploit.com/research/misc/mwsearch/index.html

Similar results can also be achieved using search keywords for specific
details in a PE / LE header. For example -

Search for ["intext: Image File Header" filetype:scr] gives almost the same
result as ["intext: signature: 5A4D" filetype:scr]

Found by : ketusa